Why I Chose Regex Over AST Parsing in My SAST Tool (And When That Would Be Wrong)

In my last article , I mentioned that my SAST tool uses regex-based pattern matching instead of AST parsing, and that this was a deliberate tradeoff. A few people asked me to go deeper on that decision — because on the surface, it sounds like I took a shortcut. I didn't. Or rather — I did, but it was an informed shortcut, and there's a meaningful difference. Let me explain what AST parsing actually is, why it's considered the "correct" approach, why I chose not to use it, and — most importantly